Setup NAT to Web Server with SD-Wan Interface

[kish02]

Hi guys,

What is the right procedure when creating NAT to my web server. should be accessible outside using a public ip of the same subnet as my wan interface. i am using sd-wan interface. thank you in advance.

[bpozdena_FTNT · Accepted solution]

DNAT on Fortigate is configured using Virtual IPs.  It's exactly the same with or without SDWAN.

See the below documentation for more details:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/728694/destination-nat

[bpozdena_FTNT · Accepted solution]

DNAT on Fortigate is configured using Virtual IPs.  It's exactly the same with or without SDWAN.

See the below documentation for more details:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/728694/destination-nat

[kish02]

Sorry for the late response, got busy with other matters. Once i have configured the virtual ip, do i need to create a firewall policy?

VIP setup

Type: Static Nat
External IP: Wan1 public ip(i have other static ip aside from what is set on wan1 interface)

Map to: Local test server

I have searched for DNAT procedures online and they created firewall policy as well.

[AEK · Accepted solution]

Yes you need a firewall policy, like this:

• srcintf: e.g.: WAN
• dstintf: e.g.: DMZ
• src: ALL (or some public IP, or some GeoIP)
• dst: VIP_object
• service: HTTPS or other
• UTM: any security you need

[kish02]

Thanks for the quick response. I am using sd-wan interface with 2 ISPs as member. Will it still work if i setup like below:

• srcintf: virtual-wan interface
• dstintf: e.g.: DMZ
• src: ALL (or some public IP, or some GeoIP)
• dst: VIP_object
• service: HTTPS or other
• UTM: any security you need

[AEK]

Sure it will.

[kish02]

Thank you.

[AEK]

Hi @kish02 

When configuring DNAT, you can either use the WAN interface's IP or use another public IP (if your ISP has provided you with extra public IP addresses).

[hbac]

Hi @kish02,

Please refer to this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

Regards,